harnesses

package
v0.17.3 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 3, 2026 License: MIT Imports: 34 Imported by: 0

Documentation

Index

Constants

View Source
const (
	PortableRuntimeTransportSubprocess PortableRuntimeTransport = "subprocess"
	PortableRuntimeTransportNative     PortableRuntimeTransport = "native"
	PortableRuntimeTransportEmbedded   PortableRuntimeTransport = "embedded"
	PortableRuntimeTransportHTTP       PortableRuntimeTransport = "http"

	PortableRuntimeInclusionRequired      PortableRuntimeInclusion = "required"
	PortableRuntimeInclusionNonSubprocess PortableRuntimeInclusion = "non_subprocess"
	PortableRuntimeInclusionExactPinOnly  PortableRuntimeInclusion = "exact_pin_only"
	PortableRuntimeInclusionTestOnly      PortableRuntimeInclusion = "test_only"

	PortableRuntimeStructuralUnpinned      PortableRuntimeStructuralMode = "unpinned"
	PortableRuntimeStructuralExactPinOnly  PortableRuntimeStructuralMode = "exact_pin_only"
	PortableRuntimeStructuralNonSubprocess PortableRuntimeStructuralMode = "non_subprocess"
)
View Source
const (
	PortableRuntimeAssetExecutable  PortableRuntimeAssetKind = "executable"
	PortableRuntimeAssetInstallTree PortableRuntimeAssetKind = "install_tree"
	PortableRuntimeAssetConfig      PortableRuntimeAssetKind = "config"
	PortableRuntimeAssetCredential  PortableRuntimeAssetKind = "credential"
	PortableRuntimeAssetQuota       PortableRuntimeAssetKind = "quota"
	PortableRuntimeAssetCache       PortableRuntimeAssetKind = "cache"
	PortableRuntimeAssetSupport     PortableRuntimeAssetKind = "runtime_support"

	PortableRuntimePathFile PortableRuntimePathKind = "file"
	PortableRuntimePathTree PortableRuntimePathKind = "tree"

	PortableRuntimeClosureStatic      PortableRuntimeClosureClass = "static"
	PortableRuntimeClosureDynamic     PortableRuntimeClosureClass = "dynamic"
	PortableRuntimeClosureInterpreted PortableRuntimeClosureClass = "interpreted"

	PortableRuntimeGuestPathRuntime PortableRuntimeGuestPathScope = "runtime"
	PortableRuntimeGuestPathHome    PortableRuntimeGuestPathScope = "home"
	PortableRuntimeGuestPathConfig  PortableRuntimeGuestPathScope = "config"
	PortableRuntimeGuestPathData    PortableRuntimeGuestPathScope = "data"
	PortableRuntimeGuestPathCache   PortableRuntimeGuestPathScope = "cache"
	PortableRuntimeGuestPathState   PortableRuntimeGuestPathScope = "state"
	PortableRuntimeGuestPathTmp     PortableRuntimeGuestPathScope = "tmp"

	PortableRuntimeEnvironmentFixedTrue   PortableRuntimeEnvironmentConstraintKind = "fixed_true"
	PortableRuntimeEnvironmentFixedFalse  PortableRuntimeEnvironmentConstraintKind = "fixed_false"
	PortableRuntimeEnvironmentGuestPath   PortableRuntimeEnvironmentConstraintKind = "guest_path"
	PortableRuntimeEnvironmentUnset       PortableRuntimeEnvironmentConstraintKind = "unset"
	PortableRuntimeEnvironmentRuntimePath PortableRuntimeEnvironmentConstraintKind = "runtime_path"
)
View Source
const (
	UsageSourceNativeStream     = "native_stream"
	UsageSourceNativeTokenCount = "native_token_count" // #nosec G101 -- usage source identifier, not a credential.
	UsageSourceTranscript       = "transcript"
	UsageSourceStatusOutput     = "status_output"
	UsageSourceFallback         = "fallback"

	UsageWarningMalformed    = "usage_malformed"
	UsageWarningDisagreement = "usage_source_disagreement"
)
View Source
const EmbeddedDiscoverySource = "embedded-cassette"

Variables

View Source
var (
	// ErrRouteRunnerAlreadyRegistered reports an attempted replacement. Exact
	// registrations are immutable for the lifetime of the authority.
	ErrRouteRunnerAlreadyRegistered = errors.New("route runner already registered")
	// ErrRouteRunnerUnavailable reports a factory result without a runner.
	ErrRouteRunnerUnavailable = errors.New("route runner unavailable")
	// ErrRouteRunnerIdentityConflict reports one runner object being assigned
	// to more than one exact route key.
	ErrRouteRunnerIdentityConflict = errors.New("route runner identity already bound to a different route")
)
View Source
var (
	// ErrContinuationRequestInvalid reports an empty parent Fizeau session ID
	// or a child request that has not been normalized by service orchestration.
	ErrContinuationRequestInvalid = errors.New("invalid continuation request")

	// ErrContinuationEvidenceUnavailable reports that a continuation-capable
	// route cannot reopen usable private evidence for the requested parent.
	ErrContinuationEvidenceUnavailable = errors.New("continuation evidence unavailable")
)
View Source
var (
	ErrPortableRuntimeTargetUnsupported = errors.New("portable runtime target unsupported")
	ErrPortableRuntimeClosureIncomplete = errors.New("portable runtime asset closure incomplete")
)
View Source
var ErrAliasNotResolvable = errors.New("model alias not resolvable from snapshot")

ErrAliasNotResolvable is returned by ModelDiscoveryHarness.ResolveModelAlias when the requested family is not recognized or the supplied discovery snapshot has no matching concrete model.

View Source
var ErrModelDiscoveryEvidenceMissing = errors.New("model discovery evidence missing")

ErrModelDiscoveryEvidenceMissing is returned by ModelDiscoveryHarness.DefaultModelSnapshot when live evidence cannot be obtained (PTY failure, parse failure, etc.) and no static fallback is available per the no-static-fallback principle.

View Source
var PreferenceOrder = []string{"codex", "claude-tui", "claude", "grok", "opencode", "fiz", "pi", "openrouter", "lmstudio", "omlx", "lucebox", "vllm", "gemini"}

PreferenceOrder defines the default harness preference when multiple are available.

Functions

func AdapterReasoningValue

func AdapterReasoningValue(req ExecuteRequest) string

AdapterReasoningValue resolves the public reasoning scalar into the value subprocess harnesses should pass to their native CLI flag. Empty, auto, off, and numeric 0 intentionally emit no flag.

func BoolPtr

func BoolPtr(v bool) *bool

func BuildPortableRuntimeBatchCommand added in v0.15.0

func BuildPortableRuntimeBatchCommand(binding PortableRuntimeRunnerBinding, registryArgv, requestArgv []string) (*exec.Cmd, *processlifecycle.PortableLaunchAttachment, error)

BuildPortableRuntimeBatchCommand turns a bound portable runner recipe into the sole command passed to the lifecycle-owned spawn seam. Registry argv and request argv remain distinct so the manifest's fixed prefix is always ordered before them. The returned attachment makes StartBatch reject any later command, argv, or environment substitution.

Callers must use this only for an activated binding. Unbound runners retain their normal configured-Binary/PATH discovery behavior.

func BuildPortableRuntimeLaunchCommand added in v0.15.0

func BuildPortableRuntimeLaunchCommand(guestRoot string, contribution PortableRuntimeContribution, requestArgv []string) (string, []string, error)

BuildPortableRuntimeLaunchCommand expands a typed launch recipe below one fixed guest root. requestArgv follows the manifest-owned fixed prefix. It never consults PATH, PT_INTERP, or a shebang.

func BuildPortableRuntimeLaunchCommandWithArguments added in v0.15.0

func BuildPortableRuntimeLaunchCommandWithArguments(guestRoot string, contribution PortableRuntimeContribution, registryArgv, requestArgv []string) (string, []string, error)

BuildPortableRuntimeLaunchCommandWithArguments preserves the distinct manifest-fixed, registry, and request argument boundaries.

func HarnessBatchCommand added in v0.15.0

func HarnessBatchCommand(binary string, args ...string) *exec.Cmd

HarnessBatchCommand constructs an *exec.Cmd for a known harness binary.

binary must be a path resolved by the runner from a HarnessConfig.Binary (looked up via LookPathFunc / exec.LookPath against a fixed allowlist of builtin harness names: "codex", "claude", "gemini", "opencode", "pi", ...). args are the harness-specific argument vector assembled from the runner's HarnessConfig + per-request fields.

This seam exists to localize the gosec G204 (subprocess launched with variable) safety contract in one place rather than annotating each caller. HarnessBatchCommand constructs a command whose cancellation is owned by the shared process-lifecycle supervisor. Do not replace this with CommandContext: its hidden cancellation path can kill the trusted supervisor before it has reaped the contained harness group.

func HarnessCombinedOutput added in v0.15.0

func HarnessCombinedOutput(ctx context.Context, harness, binary string, args ...string) ([]byte, error)

HarnessCombinedOutput runs one bounded auxiliary harness command through the same durable lifecycle supervisor as a full batch invocation. Model/help/ version/account/quota probes must use this helper instead of calling an *exec.Cmd Run/Output method directly.

func IntPtr

func IntPtr(v int) *int

func LogRunnerReasoningWarning added in v0.12.2

func LogRunnerReasoningWarning(resolution ReasoningActual)

func MirrorEvents

func MirrorEvents(dst chan<- Event, log io.Writer, ctx context.Context) (chan Event, <-chan struct{})

func OpenProgressLog

func OpenProgressLog(sessionLogDir, sessionID, prefix string) (*os.File, error)

func PortableRuntimeFileDigest added in v0.15.0

func PortableRuntimeFileDigest(source string) (string, error)

PortableRuntimeFileDigest returns the ordinary lowercase SHA-256 digest of one stable regular file. Symlinks, replacements, and concurrent mutation fail with a redacted closure error.

func PortableRuntimeTreeDigest added in v0.15.0

func PortableRuntimeTreeDigest(source string) (string, error)

PortableRuntimeTreeDigest returns SHA-256 over a versioned canonical sorted manifest of relative path, declared type, owner permission bits, and regular file content digest. Safe in-tree regular-file symlinks are normalized to independent file records; other symlinks and special files are rejected.

func QuotaStateFromUsedPercent

func QuotaStateFromUsedPercent(usedPercent int) string

QuotaStateFromUsedPercent maps a usage percentage to a quota state string.

func RegisterHarnessSession added in v0.14.33

func RegisterHarnessSession(sessionLogDir, sessionID, harnessName string, cmd *exec.Cmd) error

RegisterHarnessSession delegates transitional post-start registration to the neutral lifecycle owner. New runners use processlifecycle.Acquire.

func RegisterPTYSessionStarterForTest added in v0.15.0

func RegisterPTYSessionStarterForTest(harnessName, executable string, starter PTYSessionStarter) func()

RegisterPTYSessionStarterForTest installs a harness-agnostic PTY starter for one harness identity and exact resolved executable path. Only one registration may own a key at a time. The returned restore function is safe to call repeatedly.

The callback receives isolated copies of mutable invocation arguments. It is invoked outside the registry lock, and a panic is converted to a start error.

func ResolveFinalUsage

func ResolveFinalUsage(candidates []UsageCandidate) (*FinalUsage, []FinalWarning)

ResolveFinalUsage applies the documented source precedence: native_stream > transcript > status_output > fallback. It returns nil usage when no source reported a token count, while still returning warnings for malformed sources or source disagreements.

func ResolveHarnessAlias

func ResolveHarnessAlias(name string) string

ResolveHarnessAlias returns the canonical harness name for an alias, or the input unchanged if it is not an alias.

func ShouldEmitRunnerDefaultResolution added in v0.12.2

func ShouldEmitRunnerDefaultResolution(resolution RunnerModelResolution) bool

func ShouldEmitRunnerReasoningResolution added in v0.12.2

func ShouldEmitRunnerReasoningResolution(resolution ReasoningActual) bool

func ValidatePortableRuntimeContribution added in v0.15.0

func ValidatePortableRuntimeContribution(target PortableRuntimeTarget, contribution PortableRuntimeContribution) error

ValidatePortableRuntimeContribution validates a contribution without retaining its normalized form.

func ValidatePortableRuntimeTarget added in v0.15.0

func ValidatePortableRuntimeTarget(target PortableRuntimeTarget) error

ValidatePortableRuntimeTarget validates the Linux same-platform target required by portable runtime v0.15.

func WriteProgressEvent

func WriteProgressEvent(log io.Writer, ev Event)

Types

type AccountHarness added in v0.14.1

type AccountHarness interface {
	Harness

	// AccountStatus returns the harness's current account/auth state.
	// Cheap; reads cached evidence only. Absence of evidence is
	// reported via AccountSnapshot fields on a valid snapshot; the
	// error return is reserved for call failure.
	AccountStatus(ctx context.Context, now time.Time) (AccountSnapshot, error)

	// RefreshAccount drives the harness's account probe and persists
	// the result. Single-flight per harness instance; concurrent
	// callers block. Probe failure is reported via AccountSnapshot
	// fields, not as an error.
	RefreshAccount(ctx context.Context) (AccountSnapshot, error)

	// AccountFreshness returns the harness's account freshness window
	// (e.g. 7 days for gemini). Constant for the harness; cheap.
	AccountFreshness() time.Duration
}

AccountHarness is implemented by harnesses that expose authentication or account state independent of quota. See CONTRACT-004 for the full normative contract.

type AccountInfo

type AccountInfo struct {
	Email    string `json:"email,omitempty"`
	PlanType string `json:"plan_type,omitempty"`
	OrgName  string `json:"org_name,omitempty"`
}

AccountInfo captures provider account metadata from local auth files.

type AccountSnapshot added in v0.14.1

type AccountSnapshot struct {
	Authenticated   bool
	Unauthenticated bool
	Email           string
	PlanType        string
	OrgName         string
	Source          string // file path, env var name, "cache", "cli"
	CapturedAt      time.Time
	Fresh           bool
	Detail          string // free-form diagnostic detail
}

AccountSnapshot is the universal account/auth report defined by CONTRACT-004. Projects onto the public AccountStatus type defined in CONTRACT-003.

type ContextCapacityData added in v0.15.0

type ContextCapacityData struct {
	Action                 string `json:"action"`
	CallKind               string `json:"call_kind"`
	TurnIndex              int    `json:"turn_index"`
	AttemptIndex           int    `json:"attempt_index"`
	ContextWindow          int    `json:"context_window"`
	EffectiveContextWindow int    `json:"effective_context_window"`
	EstimatedInputTokens   int    `json:"estimated_input_tokens"`
	RequestedMaxTokens     int    `json:"requested_max_tokens"`
	EffectiveMaxTokens     int    `json:"effective_max_tokens"`
	AvailableOutputTokens  int    `json:"available_output_tokens"`
}

ContextCapacityData is the API-neutral bridge for a service-owned native context-capacity decision. Harness-native parsers never originate it.

type ContextModelDiscoveryHarness added in v0.15.0

type ContextModelDiscoveryHarness interface {
	ModelDiscoveryHarness

	// DefaultModelSnapshotWithContext returns live discovery evidence while
	// honoring ctx. Implementations must not replace ctx with a background
	// context, and must finish process cleanup before returning cancellation.
	DefaultModelSnapshotWithContext(ctx context.Context) (ModelDiscoverySnapshot, error)
}

ContextModelDiscoveryHarness is the optional cancellation-aware extension to ModelDiscoveryHarness. Service-owned refreshers prefer this interface so their exact lifecycle context reaches live model-discovery probes. The context-free DefaultModelSnapshot method remains available for legacy callers and harness implementations.

type ContinuationHarness added in v0.15.0

type ContinuationHarness interface {
	Harness

	PrepareContinuation(context.Context, ContinuationRequest) (PreparedContinuation, error)
}

ContinuationHarness is the optional route-specific continuation capability. PrepareContinuation resolves ParentSessionID through durable evidence owned privately by this runner. Missing, unreadable, stale, or rejected evidence returns ErrContinuationEvidenceUnavailable without creating a child, acquiring a lease, spawning, or returning an event channel.

type ContinuationRequest added in v0.15.0

type ContinuationRequest struct {
	ParentSessionID string
	Request         ExecuteRequest
}

ContinuationRequest asks the selected route-owned runner to resume the completed Fizeau session identified by ParentSessionID. ParentSessionID is the only conversation identifier on this boundary. Request is the fully normalized execution request for the new child invocation; it carries no continuation policy or harness-native continuation evidence.

type CostSource added in v0.15.0

type CostSource string

CostSource identifies the provenance of final cost data.

const (
	CostSourceReported   CostSource = "reported"
	CostSourceConfigured CostSource = "configured"
	CostSourceUnknown    CostSource = "unknown"
)

type Event

type Event struct {
	Type     EventType         `json:"type"`
	Sequence int64             `json:"sequence"`
	Time     time.Time         `json:"time"`
	Metadata map[string]string `json:"metadata,omitempty"`
	Data     json.RawMessage   `json:"data"`
}

Event is the structured event a harness emits during Execute. It mirrors the shape defined in CONTRACT-003 §"Event JSON shapes". The Data field is a JSON-encoded payload whose schema is determined by Type.

func RunnerDefaultResolutionEvent added in v0.12.2

func RunnerDefaultResolutionEvent(resolution RunnerModelResolution, metadata map[string]string, seq *int64) Event

func RunnerReasoningResolutionEvent added in v0.12.2

func RunnerReasoningResolutionEvent(resolution ReasoningActual, metadata map[string]string, seq *int64) Event

type EventType

type EventType string

EventType identifies the kind of event a harness emits during execution.

The set is the closed union defined by CONTRACT-003 ("Event JSON shapes"): every backend (native + subprocess) emits these identically so the agent loop can multiplex them onto a single channel.

const (
	EventTypeTextDelta       EventType = "text_delta"
	EventTypeToolCall        EventType = "tool_call"
	EventTypeToolResult      EventType = "tool_result"
	EventTypeCompaction      EventType = "compaction"
	EventTypeProgress        EventType = "progress"
	EventTypeRoutingDecision EventType = "routing_decision"
	EventTypeStall           EventType = "stall"
	EventTypeContextCapacity EventType = "context_capacity"
	EventTypeFinal           EventType = "final"
)

type ExecuteRequest

type ExecuteRequest struct {
	// Prompt is the resolved user prompt sent to the model.
	Prompt string

	// SystemPrompt is the resolved system prompt; empty means harness default.
	SystemPrompt string

	// Provider is the resolved provider identifier when applicable. May be
	// empty for harnesses that have no provider concept (e.g. claude CLI).
	Provider string

	// Model is the resolved model identifier; empty means harness default.
	Model string

	// WorkDir is the working directory for tool operations. Required when
	// the chosen harness uses tools.
	WorkDir string

	// Permissions is "safe" | "supervised" | "unrestricted". Empty defaults to "safe".
	Permissions string

	// Temperature is the model sampling temperature requested by the caller.
	// Harness adapters may ignore it when their CLI has no equivalent control.
	Temperature float32

	// Seed is the requested sampling seed. Zero means unset/provider chooses.
	// Harness adapters may ignore it when their CLI has no equivalent control.
	Seed int64

	// Reasoning is the normalized public reasoning scalar. Empty/off means no
	// adapter flag should be emitted.
	Reasoning string

	// Timeout is the wall-clock cap for the entire request. 0 disables.
	Timeout time.Duration

	// IdleTimeout is the streaming-quiet cap. 0 uses harness default.
	IdleTimeout time.Duration

	// SessionLogDir overrides the per-run session-log directory; harness
	// uses this to direct progress traces into a per-bundle evidence dir.
	SessionLogDir string

	// SessionID is a stable identifier for the run, used in progress log
	// filenames and event metadata. Empty means the harness generates one.
	SessionID string

	// LifecycleStateDir is the service-selected directory for durable process
	// ownership records. It is separate from the human-readable session log.
	LifecycleStateDir string

	// CleanupTimeout is the service-owned deadline for stopping and proving the
	// per-invocation containment boundary empty.
	CleanupTimeout time.Duration

	// Metadata is echoed back into Event.Metadata (e.g. bead_id, attempt_id).
	Metadata map[string]string
}

ExecuteRequest is the internal request carried into Harness.Execute. It is intentionally narrower than the public ExecuteRequest in CONTRACT-003: the agent's routing layer is expected to resolve provider/model/reasoning /permissions/timeouts before invoking a harness, so the harness sees a concrete, ready-to-run request.

type FinalData

type FinalData struct {
	Status          string               `json:"status"` // success|iteration_limit|failed|stalled|timed_out|cancelled
	Outcome         SessionOutcome       `json:"outcome"`
	Cause           TerminalCause        `json:"cause"`
	Stage           SessionStage         `json:"stage"`
	PrimaryOutcome  SessionOutcome       `json:"primary_outcome,omitempty"`
	PrimaryCause    TerminalCause        `json:"primary_cause,omitempty"`
	PrimaryStage    SessionStage         `json:"primary_stage,omitempty"`
	ExitCode        int                  `json:"exit_code"`
	Error           string               `json:"error,omitempty"`
	ContextCapacity *ContextCapacityData `json:"context_capacity,omitempty"`
	FinalText       string               `json:"final_text,omitempty"`
	DurationMS      int64                `json:"duration_ms"`
	Usage           *FinalUsage          `json:"usage,omitempty"`
	Warnings        []FinalWarning       `json:"warnings,omitempty"`
	FinalCostUSD    *float64             `json:"cost_usd,omitempty"`
	FinalCostSource CostSource           `json:"cost_source"`
	// CostUSD is a temporary compatibility bridge for in-memory consumers.
	// Deprecated: use FinalCostUSD and FinalCostSource.
	CostUSD        float64           `json:"-"`
	SessionLogPath string            `json:"session_log_path,omitempty"`
	RoutingActual  *RoutingActual    `json:"routing_actual,omitempty"`
	Reasoning      *ReasoningActual  `json:"reasoning,omitempty"`
	Extra          map[string]string `json:"-"`
}

FinalData is the payload for type=final events.

func (FinalData) MarshalJSON added in v0.15.0

func (d FinalData) MarshalJSON() ([]byte, error)

MarshalJSON writes the authoritative final-cost wire contract. The deprecated scalar remains in-memory only and is never promoted to wire evidence.

func (*FinalData) UnmarshalJSON added in v0.15.0

func (d *FinalData) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts both the authoritative cost_source-tagged contract and legacy cost_usd-only payloads without inventing provenance.

type FinalUsage

type FinalUsage struct {
	InputTokens      *int                  `json:"input_tokens,omitempty"`
	OutputTokens     *int                  `json:"output_tokens,omitempty"`
	CacheReadTokens  *int                  `json:"cache_read_tokens,omitempty"`
	CacheWriteTokens *int                  `json:"cache_write_tokens,omitempty"`
	CacheTokens      *int                  `json:"cache_tokens,omitempty"`
	ReasoningTokens  *int                  `json:"reasoning_tokens,omitempty"`
	TotalTokens      *int                  `json:"total_tokens,omitempty"`
	Source           string                `json:"source,omitempty"`
	Fresh            *bool                 `json:"fresh,omitempty"`
	CapturedAt       string                `json:"captured_at,omitempty"`
	Sources          []UsageSourceEvidence `json:"sources,omitempty"`
}

FinalUsage carries token totals on a final event. Count fields are pointers so unavailable token dimensions are omitted instead of serialized as zero. A present pointer to 0 means the harness explicitly reported zero usage.

type FinalWarning

type FinalWarning struct {
	Code    string                `json:"code"`
	Message string                `json:"message,omitempty"`
	Sources []UsageSourceEvidence `json:"sources,omitempty"`
}

FinalWarning is normalized metadata about non-fatal final-event issues.

type Harness

type Harness interface {
	// Info returns identity + capability metadata for this harness.
	Info() HarnessInfo

	// HealthCheck triggers a fresh probe (binary present, auth ok, etc.)
	// and returns nil if the harness is ready to execute.
	HealthCheck(ctx context.Context) error

	// Execute runs one resolved request. Events stream on the returned
	// channel; a single final event closes the stream. The first error
	// return is reserved for setup failures (binary missing, etc.) — once
	// the channel is returned, all per-run failures are reported via a
	// final event with Status != "success".
	Execute(ctx context.Context, req ExecuteRequest) (<-chan Event, error)
}

Harness is the internal contract every harness implementation in internal/harnesses/<name> satisfies. It is the minimal surface the agent dispatcher needs to route a resolved request into a backend.

A Harness is responsible for emitting events on the returned channel until execution completes; the channel MUST be closed after the final event so downstream consumers can detect end-of-stream. The final event is always of type EventTypeFinal.

type HarnessConfig

type HarnessConfig struct {
	Name                string              // e.g. "codex", "claude", "gemini"
	Binary              string              // binary name to exec
	BaseArgs            []string            // args always included regardless of permission level
	PermissionArgs      map[string][]string // extra args keyed by permission level: "safe", "supervised", "unrestricted"
	PromptMode          string              // "arg" (final arg), "stdin" (pipe)
	DefaultModel        string              // built-in model choice when no config override exists
	ReasoningLevels     []string            // supported reasoning levels in preference order
	MaxReasoningTokens  int                 // numeric reasoning budget max; 0 = unsupported/unknown
	ModelFlag           string              // flag for model override (e.g. "-m", "--model"), empty if unsupported
	WorkDirFlag         string              // flag for working directory (e.g. "-C", "--cwd"), empty if unsupported
	ReasoningFlag       string              // adapter flag for reasoning control, empty if unsupported
	ReasoningFormat     string              // format string for adapter reasoning value, empty = use value directly
	TokenPattern        string              // regex to extract token count from output, must have one capture group
	Surface             string              // catalog surface identifier: "codex", "claude", "embedded-openai", "embedded-anthropic"
	CostClass           string              // local, cheap, medium, expensive
	IsLocal             bool                // true for embedded/local harnesses (no cloud cost)
	ExactPinSupport     bool                // true if harness can accept an exact concrete model pin
	QuotaCommand        string              // CLI args for non-interactive quota introspection; empty = skip probe
	TUIQuotaCommand     string              // Slash command to send as a prompt when native quota signal is unavailable
	IsHTTPProvider      bool                // true for API-only providers (openrouter, lmstudio) that have no CLI binary
	IsSubscription      bool                // true for fixed-subscription harnesses (codex, claude)
	AutoRoutingEligible bool                // true when this harness has full coverage and may be selected by unattended profile routing
	TestOnly            bool                // true for sentinel/test harnesses that must never be selected by production tier routing
}

HarnessConfig defines a known agent harness's invocation metadata. This is a configuration struct (not an interface) that captures binary, args, flags, and capability metadata for each builtin harness.

type HarnessInfo

type HarnessInfo struct {
	Name                 string
	Type                 string // "native" | "subprocess"
	Available            bool
	Path                 string
	Error                string
	IsLocal              bool
	IsSubscription       bool
	AutoRoutingEligible  bool
	ExactPinSupport      bool
	DefaultModel         string
	SupportedPermissions []string
	SupportedReasoning   []string
	CostClass            string
}

HarnessInfo describes a registered harness. Mirrors the public HarnessInfo type defined in CONTRACT-003. Internal callers use this to implement the public ListHarnesses surface without re-declaring the shape.

type HarnessOutputPipes added in v0.15.0

type HarnessOutputPipes struct {
	Stdout *os.File
	Stderr *os.File
	// contains filtered or unexported fields
}

HarnessOutputPipes owns the parent ends of a subprocess harness's stdout and stderr pipes. The write ends are assigned directly to cmd instead of using exec.Cmd.StdoutPipe or StderrPipe: processlifecycle waits for its trusted supervisor in the background, and exec.Cmd.Wait is allowed to close descriptors created by those convenience methods before readers finish.

func PrepareHarnessOutputPipes added in v0.15.0

func PrepareHarnessOutputPipes(cmd *exec.Cmd) (*HarnessOutputPipes, error)

PrepareHarnessOutputPipes attaches caller-owned stdout and stderr pipes to cmd. Call ReleaseWriters immediately after a successful StartBatch, and defer Close on every path.

func (*HarnessOutputPipes) Close added in v0.15.0

func (p *HarnessOutputPipes) Close() error

Close releases every pipe end still owned by the embedding process.

func (*HarnessOutputPipes) ReleaseWriters added in v0.15.0

func (p *HarnessOutputPipes) ReleaseWriters() error

ReleaseWriters drops the embedding process's copies after StartBatch has inherited them. EOF then arrives as soon as the supervisor and its child close their copies.

type HarnessSessionRecord added in v0.14.33

type HarnessSessionRecord = processlifecycle.LegacyHarnessSessionRecord

HarnessSessionRecord is retained as a source-compatible alias while callers migrate from the explicitly transitional flat reaper schema.

type HarnessState

type HarnessState struct {
	Installed       bool       `json:"installed"`
	Reachable       bool       `json:"reachable"`
	Authenticated   bool       `json:"authenticated"`
	QuotaOK         bool       `json:"quota_ok"`
	QuotaState      string     `json:"quota_state,omitempty"` // ok, blocked, unknown
	Degraded        bool       `json:"degraded"`
	PolicyOK        bool       `json:"policy_ok"`
	LastCheckedUnix int64      `json:"last_checked_unix,omitempty"`
	Error           string     `json:"error,omitempty"`
	Quota           *QuotaInfo `json:"quota,omitempty"`
}

HarnessState captures the runtime routing-relevant state of a harness.

type HarnessStatus

type HarnessStatus struct {
	Name      string `json:"name"`
	Available bool   `json:"available"`
	Binary    string `json:"binary"`
	Path      string `json:"path,omitempty"` // resolved binary path
	Error     string `json:"error,omitempty"`
}

HarnessStatus reports availability of a harness.

type LookPathFunc

type LookPathFunc func(file string) (string, error)

LookPathFunc abstracts binary discovery for testability.

var DefaultLookPath LookPathFunc = exec.LookPath

DefaultLookPath is the production implementation.

type ModelDiscoveryCache added in v0.12.2

type ModelDiscoveryCache struct {
	// contains filtered or unexported fields
}

ModelDiscoveryCache memoizes in-process discovery snapshots by harness and source. The embedded source is populated from the registry's cassette-backed model lists; live PTY refresh is intentionally out of scope here.

func NewModelDiscoveryCache added in v0.12.2

func NewModelDiscoveryCache(loader ModelDiscoveryLoader) *ModelDiscoveryCache

func (*ModelDiscoveryCache) Snapshot added in v0.12.2

func (c *ModelDiscoveryCache) Snapshot(harnessName, source string) (ModelDiscoverySnapshot, error)

type ModelDiscoveryHarness added in v0.14.1

type ModelDiscoveryHarness interface {
	Harness

	// DefaultModelSnapshot returns the harness's seed/fallback
	// discovery snapshot. Used to bootstrap the catalog before the
	// first live refresh lands. Per the no-static-fallback principle,
	// returns ErrModelDiscoveryEvidenceMissing when live evidence cannot
	// be obtained; never returns a cached or literal fallback.
	DefaultModelSnapshot() (ModelDiscoverySnapshot, error)

	// ResolveModelAlias maps a family-style requested model to a
	// concrete model ID using the provided discovery snapshot.
	// Returns ErrAliasNotResolvable if the family is not recognized
	// or the snapshot has no matching concrete model.
	ResolveModelAlias(family string, snapshot ModelDiscoverySnapshot) (string, error)

	// SupportedAliases returns the harness's stable set of family
	// aliases ResolveModelAlias recognizes. Constant for the harness;
	// the conformance suite uses this value to verify
	// ResolveModelAlias covers each documented family (positive path)
	// and rejects out-of-set families with ErrAliasNotResolvable
	// (negative path). Empty slice is allowed for harnesses that
	// recognize no family aliases.
	SupportedAliases() []string
}

ModelDiscoveryHarness is implemented by harnesses whose model surface extends beyond a single Info().DefaultModel — i.e. they support family aliases (sonnet, gpt, gemini) that resolve through discovery evidence. See CONTRACT-004 for the full normative contract.

type ModelDiscoveryLoader added in v0.12.2

type ModelDiscoveryLoader func(harnessName, source string) (ModelDiscoverySnapshot, error)

type ModelDiscoverySnapshot

type ModelDiscoverySnapshot struct {
	CapturedAt      time.Time `json:"captured_at"`
	Models          []string  `json:"models,omitempty"`
	ReasoningLevels []string  `json:"reasoning_levels,omitempty"`
	Source          string    `json:"source"`
	FreshnessWindow string    `json:"freshness_window,omitempty"`
	Detail          string    `json:"detail,omitempty"`
}

ModelDiscoverySnapshot captures model and reasoning capability evidence for harnesses whose source of truth is a CLI/TUI surface instead of /v1/models.

func CachedModelDiscoverySnapshot added in v0.12.2

func CachedModelDiscoverySnapshot(harnessName, source string) (ModelDiscoverySnapshot, error)

func LoadEmbeddedModelDiscoverySnapshot added in v0.12.2

func LoadEmbeddedModelDiscoverySnapshot(harnessName, source string) (ModelDiscoverySnapshot, error)

type PTYSessionStarter added in v0.15.0

type PTYSessionStarter func(
	ctx context.Context,
	command string,
	args []string,
	workdir string,
	env []string,
	size session.Size,
	opts ...session.Option,
) (*session.Session, error)

PTYSessionStarter matches session.Start. Registered test replacements run synchronously at the real startup call site and must return promptly.

func LookupPTYSessionStarterForTest added in v0.15.0

func LookupPTYSessionStarterForTest(harnessName, executable string) (PTYSessionStarter, bool)

LookupPTYSessionStarterForTest returns the replacement for one exact test key. Production finds no registration and uses its real starter.

type PortableRuntimeAsset added in v0.15.0

type PortableRuntimeAsset struct {
	Kind          PortableRuntimeAssetKind
	PathKind      PortableRuntimePathKind
	Source        string
	Target        string
	ContentSHA256 string
	Executable    bool
}

PortableRuntimeAsset is one harness-owned member of a verified executable or state closure. Source remains internal and may be sensitive. Target is a clean slash-relative path below the portable runtime guest root.

type PortableRuntimeAssetKind added in v0.15.0

type PortableRuntimeAssetKind string

type PortableRuntimeChildCommand added in v0.15.0

type PortableRuntimeChildCommand struct {
	// contains filtered or unexported fields
}

PortableRuntimeChildCommand is a pure spawn specification. It owns the exact executable, argv, closed environment, and opaque namespace recipe.

func (PortableRuntimeChildCommand) Arguments added in v0.15.0

func (c PortableRuntimeChildCommand) Arguments() []string

func (PortableRuntimeChildCommand) Command added in v0.15.0

func (c PortableRuntimeChildCommand) Command() string

func (PortableRuntimeChildCommand) Environment added in v0.15.0

func (c PortableRuntimeChildCommand) Environment() []string

func (PortableRuntimeChildCommand) GoString added in v0.15.0

func (c PortableRuntimeChildCommand) GoString() string

func (PortableRuntimeChildCommand) MarshalJSON added in v0.15.0

func (c PortableRuntimeChildCommand) MarshalJSON() ([]byte, error)

func (PortableRuntimeChildCommand) NamespaceRecipe added in v0.15.0

func (PortableRuntimeChildCommand) String added in v0.15.0

type PortableRuntimeClosureClass added in v0.15.0

type PortableRuntimeClosureClass string

type PortableRuntimeContribution added in v0.15.0

type PortableRuntimeContribution struct {
	ClosureClass         PortableRuntimeClosureClass
	Launch               PortableRuntimeLaunch
	Assets               []PortableRuntimeAsset
	Environment          []PortableRuntimeEnvironment
	ExecutionConstraints PortableRuntimeExecutionConstraints
	StateProjections     []PortableRuntimeStateProjection
}

func AnalyzePortableRuntimeDynamicClosure added in v0.15.0

func AnalyzePortableRuntimeDynamicClosure(ctx context.Context, target PortableRuntimeTarget, request PortableRuntimeDynamicClosureRequest) (PortableRuntimeContribution, error)

AnalyzePortableRuntimeDynamicClosure verifies PT_INTERP and every recursive DT_NEEDED edge against the explicitly declared library roots, then emits a loader --library-path recipe. The copied binary's PT_INTERP is never used.

func AnalyzePortableRuntimeInterpretedClosure added in v0.15.0

func AnalyzePortableRuntimeInterpretedClosure(ctx context.Context, target PortableRuntimeTarget, request PortableRuntimeInterpretedClosureRequest) (PortableRuntimeContribution, error)

AnalyzePortableRuntimeInterpretedClosure verifies a script launcher and the interpreter's complete static or dynamic ELF closure. Its launch recipe invokes the bundled interpreter directly and never follows the shebang.

func AnalyzePortableRuntimeStaticClosure added in v0.15.0

func AnalyzePortableRuntimeStaticClosure(ctx context.Context, target PortableRuntimeTarget, request PortableRuntimeStaticClosureRequest) (PortableRuntimeContribution, error)

AnalyzePortableRuntimeStaticClosure resolves a symlinked launcher, verifies a same-architecture Linux ELF without PT_INTERP, and emits a direct launch.

func NormalizePortableRuntimeContribution added in v0.15.0

func NormalizePortableRuntimeContribution(target PortableRuntimeTarget, contribution PortableRuntimeContribution) (PortableRuntimeContribution, error)

NormalizePortableRuntimeContribution validates and returns an owned, deterministic contribution. Asset, environment, state-projection, and execution-constraint ordering is canonical; launch, fixed-argument, and fixed-option/value ordering is retained because it is part of execution semantics.

type PortableRuntimeDynamicClosureRequest added in v0.15.0

type PortableRuntimeDynamicClosureRequest struct {
	EntrypointSource string
	EntrypointTarget string
	LoaderTarget     string
	LibraryRoots     []PortableRuntimeSourceTree
	// ExactLibraryRoots emit only the recursive DT_NEEDED files selected from
	// unique candidates. Exactly one of LibraryRoots and ExactLibraryRoots must
	// be set.
	ExactLibraryRoots []PortableRuntimeLibrarySearchRoot
	RuntimeLookup     PortableRuntimeLookupPolicy
	RuntimeTrees      []PortableRuntimeSourceTree
}

PortableRuntimeDynamicClosureRequest describes a recognized dynamically linked Linux executable layout. Tree-backed LibraryRoots are searched in order. ExactLibraryRoots require one unique candidate for every dependency; their original order is retained after unused roots are removed.

type PortableRuntimeEnvironment added in v0.15.0

type PortableRuntimeEnvironment struct {
	Name string
}

PortableRuntimeEnvironment carries an inherited variable name only. It cannot represent a value or a name=value assignment.

type PortableRuntimeEnvironmentConstraint added in v0.15.0

type PortableRuntimeEnvironmentConstraint struct {
	Name      string
	Kind      PortableRuntimeEnvironmentConstraintKind
	GuestPath PortableRuntimeGuestPath
}

PortableRuntimeEnvironmentConstraint declares one activation-owned environment treatment without carrying a raw environment value.

type PortableRuntimeEnvironmentConstraintKind added in v0.15.0

type PortableRuntimeEnvironmentConstraintKind string

type PortableRuntimeExecutionConstraints added in v0.15.0

type PortableRuntimeExecutionConstraints struct {
	Environment         []PortableRuntimeEnvironmentConstraint
	ReadOnlyPaths       []PortableRuntimeGuestPath
	RequiredAbsentPaths []PortableRuntimeGuestPath
	FixedArguments      []string
	FixedOptionValues   []PortableRuntimeFixedOptionValue
}

PortableRuntimeExecutionConstraints is harness-declared execution evidence. Activation interprets it generically after materialization persists it.

type PortableRuntimeFileIdentity added in v0.15.0

type PortableRuntimeFileIdentity struct {
	Size          int64
	ContentSHA256 string
}

PortableRuntimeFileIdentity is a contributor-supplied exact identity for one regular runtime file. It does not carry publisher, release, build, or probe evidence; the contributing harness owns that evidence separately.

type PortableRuntimeFixedOptionValue added in v0.15.0

type PortableRuntimeFixedOptionValue struct {
	Option string
	Value  string
}

PortableRuntimeFixedOptionValue declares one fixed option followed by one fixed, non-secret literal value. It cannot represent a free positional argument or an option=value assignment.

type PortableRuntimeGuestPath added in v0.15.0

type PortableRuntimeGuestPath struct {
	Scope  PortableRuntimeGuestPathScope
	Target string
}

PortableRuntimeGuestPath identifies a path beneath one activation-owned guest root. Target is slash-relative and never carries a host path.

type PortableRuntimeGuestPathScope added in v0.15.0

type PortableRuntimeGuestPathScope string

type PortableRuntimeHarness added in v0.15.0

type PortableRuntimeHarness interface {
	Harness

	PortableRuntimeAssets(context.Context, PortableRuntimeTarget) (PortableRuntimeContribution, error)
}

PortableRuntimeHarness is the optional harness-owned asset-discovery capability. It is read-only: it does not materialize files or start work.

type PortableRuntimeInclusion added in v0.15.0

type PortableRuntimeInclusion string

PortableRuntimeInclusion explains whether a registry row contributes a subprocess closure to an unpinned portable runtime.

type PortableRuntimeInterpretedClosureRequest added in v0.15.0

type PortableRuntimeInterpretedClosureRequest struct {
	EntrypointSource string
	EntrypointTarget string
	// EntrypointPackageTreeTarget opts into a package-tree-owned entrypoint.
	// The analyzer proves that EntrypointSource resolves to a direct regular
	// member of this exact PackageTrees target and that EntrypointTarget names
	// the same relative member. The tree then owns the emitted entrypoint; no
	// overlapping duplicate file asset is produced.
	EntrypointPackageTreeTarget string
	InterpreterSource           string
	InterpreterIdentity         PortableRuntimeFileIdentity
	InterpreterTarget           string
	LoaderTarget                string
	LibraryRoots                []PortableRuntimeSourceTree
	ExactLibraryRoots           []PortableRuntimeLibrarySearchRoot
	PackageTrees                []PortableRuntimeSourceTree
	NativeAddons                []PortableRuntimeNativeAddon
	RuntimeArgs                 []string
	RuntimeLookup               PortableRuntimeLookupPolicy
	RuntimeTrees                []PortableRuntimeSourceTree
}

PortableRuntimeInterpretedClosureRequest describes a recognized launcher, interpreter, and package-tree layout. RuntimeArgs are fixed interpreter arguments; request arguments are appended only when the recipe is activated.

type PortableRuntimeLaunch added in v0.15.0

type PortableRuntimeLaunch struct {
	EntrypointTarget string
	// EntrypointTreeMember binds an interpreted entrypoint to one exact regular
	// member of the unique install-tree asset that owns EntrypointTarget.
	EntrypointTreeMember string
	InterpreterTarget    string
	LoaderTarget         string
	RuntimeArgs          []string
	LibraryRootTargets   []string
}

PortableRuntimeLaunch is a guest-relative executable recipe. All targets are slash-relative beneath the portable runtime guest root.

type PortableRuntimeLibrarySearchRoot added in v0.15.0

type PortableRuntimeLibrarySearchRoot struct {
	Source string
	Target string
}

PortableRuntimeLibrarySearchRoot maps one host ELF search directory to one private guest search directory. Unlike PortableRuntimeSourceTree, discovery emits only the recursive dependency files actually selected from this root.

type PortableRuntimeLookupPolicy added in v0.15.0

type PortableRuntimeLookupPolicy string

PortableRuntimeLookupPolicy records the contributor's evidence about runtime-only lookup (for example dlopen or plugin discovery). The zero value is deliberately invalid so an unknown installed layout fails closed.

const (
	// PortableRuntimeLookupClosed means the recognized layout has no additional
	// runtime-only lookup beyond its statically discoverable closure.
	PortableRuntimeLookupClosed PortableRuntimeLookupPolicy = "closed"
	// PortableRuntimeLookupIncludedTrees means the declared runtime/package
	// trees contain the runtime-only lookup surface exercised by the owning
	// harness's offline layout probe.
	PortableRuntimeLookupIncludedTrees PortableRuntimeLookupPolicy = "included_trees"
	// PortableRuntimeLookupVerifiedExact means the contributor's offline probe
	// verified that a recognized single-file runtime loads no executable or
	// library code beyond the exact dependency files. It is valid only with
	// ExactLibraryRoots and no runtime trees.
	PortableRuntimeLookupVerifiedExact PortableRuntimeLookupPolicy = "verified_exact"
)

type PortableRuntimeNamespaceRecipe added in v0.15.0

type PortableRuntimeNamespaceRecipe interface {
	PortableRuntimeNamespaceRecipe()
}

PortableRuntimeNamespaceRecipe is the opaque activation-owned namespace recipe carried to the canonical spawn seam. Harnesses may retain and forward it, but cannot inspect its private enforcement details.

type PortableRuntimeNativeAddon added in v0.15.0

type PortableRuntimeNativeAddon struct {
	PackageTreeTarget string
	RelativePath      string
	Identity          PortableRuntimeFileIdentity
}

PortableRuntimeNativeAddon identifies one contributor-selected native Node addon inside an exact PackageTrees target. The neutral closure analyzer validates only declarations supplied by the contributing harness; it never scans package trees for additional .node files.

type PortableRuntimePathKind added in v0.15.0

type PortableRuntimePathKind string

type PortableRuntimeRunnerBinder added in v0.15.0

type PortableRuntimeRunnerBinder interface {
	BindPortableRuntime(PortableRuntimeRunnerBinding) error
	PortableRuntimeBinding() (PortableRuntimeRunnerBinding, bool)
}

PortableRuntimeRunnerBinder is the one generic activation-facing contract implemented by authoritative structural subprocess prototypes.

type PortableRuntimeRunnerBinding added in v0.15.0

type PortableRuntimeRunnerBinding struct {
	// contains filtered or unexported fields
}

PortableRuntimeRunnerBinding is the immutable manifest authority retained by both a structural prototype and every exact-route clone made from it. Its diagnostic forms deliberately expose only structural cardinalities.

func NewPortableRuntimeRunnerBinding added in v0.15.0

func NewPortableRuntimeRunnerBinding(input PortableRuntimeRunnerBindingInput) (PortableRuntimeRunnerBinding, error)

NewPortableRuntimeRunnerBinding validates and owns one manifest-derived runner binding. Non-subprocess surfaces carry transport authority only.

func (PortableRuntimeRunnerBinding) BuildCommand added in v0.15.0

func (b PortableRuntimeRunnerBinding) BuildCommand(registryArgv, requestArgv []string) (PortableRuntimeChildCommand, error)

BuildCommand appends registry and request arguments at their distinct governed boundaries without consulting the host process or filesystem.

func (PortableRuntimeRunnerBinding) Environment added in v0.15.0

func (b PortableRuntimeRunnerBinding) Environment() map[string]string

Environment returns an owned copy of the activation's closed child environment.

func (PortableRuntimeRunnerBinding) GoString added in v0.15.0

func (b PortableRuntimeRunnerBinding) GoString() string

func (PortableRuntimeRunnerBinding) MarshalJSON added in v0.15.0

func (b PortableRuntimeRunnerBinding) MarshalJSON() ([]byte, error)

func (PortableRuntimeRunnerBinding) NamespaceRecipe added in v0.15.0

NamespaceRecipe returns the opaque activation-owned recipe.

func (PortableRuntimeRunnerBinding) String added in v0.15.0

func (PortableRuntimeRunnerBinding) Structure added in v0.15.0

Structure returns the manifest-declared structural identity.

type PortableRuntimeRunnerBindingInput added in v0.15.0

type PortableRuntimeRunnerBindingInput struct {
	Structure         PortableRuntimeStructure
	GuestRoot         string
	ClosureClass      PortableRuntimeClosureClass
	Launch            PortableRuntimeLaunch
	FixedArguments    []string
	FixedOptionValues []PortableRuntimeFixedOptionValue
	Environment       map[string]string
	NamespaceRecipe   PortableRuntimeNamespaceRecipe
}

PortableRuntimeRunnerBindingInput is the verified, process-free input used to bind one manifest surface to an authoritative structural prototype.

func (PortableRuntimeRunnerBindingInput) GoString added in v0.15.0

func (PortableRuntimeRunnerBindingInput) MarshalJSON added in v0.15.0

func (i PortableRuntimeRunnerBindingInput) MarshalJSON() ([]byte, error)

func (PortableRuntimeRunnerBindingInput) String added in v0.15.0

type PortableRuntimeRunnerState added in v0.15.0

type PortableRuntimeRunnerState struct {
	// contains filtered or unexported fields
}

PortableRuntimeRunnerState supplies the generic binder implementation for concrete runner structs. Exact-route factories clone it with Clone.

func (*PortableRuntimeRunnerState) BindPortableRuntime added in v0.15.0

func (s *PortableRuntimeRunnerState) BindPortableRuntime(binding PortableRuntimeRunnerBinding) error

func (PortableRuntimeRunnerState) Clone added in v0.15.0

func (PortableRuntimeRunnerState) GoString added in v0.15.0

func (s PortableRuntimeRunnerState) GoString() string

func (PortableRuntimeRunnerState) MarshalJSON added in v0.15.0

func (s PortableRuntimeRunnerState) MarshalJSON() ([]byte, error)

func (*PortableRuntimeRunnerState) PortableRuntimeBinding added in v0.15.0

func (s *PortableRuntimeRunnerState) PortableRuntimeBinding() (PortableRuntimeRunnerBinding, bool)

func (PortableRuntimeRunnerState) String added in v0.15.0

type PortableRuntimeSourceTree added in v0.15.0

type PortableRuntimeSourceTree struct {
	Source string
	Target string
}

PortableRuntimeSourceTree maps one complete host tree to one private guest tree. Contributors must name roots explicitly; closure analysis never falls back to PATH, the host loader cache, or a package manager.

type PortableRuntimeStateProjection added in v0.15.0

type PortableRuntimeStateProjection struct {
	Directory PortableRuntimeGuestPath
	Entries   []PortableRuntimeStateProjectionEntry
}

PortableRuntimeStateProjection assembles immutable configuration and writable state seeds at one native harness directory. Activation, rather than file mode bits, owns the enforcement boundary between those members.

type PortableRuntimeStateProjectionEntry added in v0.15.0

type PortableRuntimeStateProjectionEntry struct {
	AssetTarget string
	Target      string
}

PortableRuntimeStateProjectionEntry maps one exact declared asset into a member below an activation-owned state projection directory. Both fields are slash-relative private manifest metadata; neither carries a host path or a value from the referenced asset.

type PortableRuntimeStaticClosureRequest added in v0.15.0

type PortableRuntimeStaticClosureRequest struct {
	EntrypointSource string
	EntrypointTarget string
	RuntimeLookup    PortableRuntimeLookupPolicy
	RuntimeTrees     []PortableRuntimeSourceTree
}

PortableRuntimeStaticClosureRequest describes a recognized static Linux executable layout.

type PortableRuntimeStructuralHarness added in v0.15.0

type PortableRuntimeStructuralHarness interface {
	PortableRuntimeStructure() PortableRuntimeStructure
}

PortableRuntimeStructuralHarness is implemented by every actual production runner instance that participates in the registry join.

type PortableRuntimeStructuralMode added in v0.15.0

type PortableRuntimeStructuralMode string

PortableRuntimeStructuralMode is the explicit route-shape capability of an actual runner, independent of model discovery and registry defaults.

type PortableRuntimeStructure added in v0.15.0

type PortableRuntimeStructure struct {
	Name      string
	Transport PortableRuntimeTransport
	Mode      PortableRuntimeStructuralMode
}

PortableRuntimeStructure is the side-effect-free structural description of one actual runner instance.

type PortableRuntimeSurface added in v0.15.0

type PortableRuntimeSurface struct {
	Name      string
	Transport PortableRuntimeTransport
	Inclusion PortableRuntimeInclusion
	Instance  Harness
}

PortableRuntimeSurface is one deterministic registry-to-instance join row. Instance is the exact service-owned runner object for subprocess/native harnesses; non-subprocess registry rows have a nil Instance.

func BuildPortableRuntimeInventory added in v0.15.0

func BuildPortableRuntimeInventory(registry *Registry, instances map[string]Harness) ([]PortableRuntimeSurface, error)

BuildPortableRuntimeInventory performs the stable, side-effect-free join of registry metadata to the actual runner-instance map owned by a configured service. It intentionally does not call Info, HealthCheck, Execute, PortableRuntimeAssets, LookPath, or any provider/routing surface.

type PortableRuntimeTarget added in v0.15.0

type PortableRuntimeTarget struct {
	GOOS   string
	GOARCH string
}

PortableRuntimeTarget is the internal Linux same-platform preparation target. Portable runtime v0.15 does not support cross-platform packaging.

type PortableRuntimeTransport added in v0.15.0

type PortableRuntimeTransport string

PortableRuntimeTransport is the actual execution transport represented by a portable-runtime inventory row. It is independent from historical registry type labels.

type PreparedContinuation added in v0.15.0

type PreparedContinuation interface {
	Start(context.Context) (<-chan Event, error)
}

PreparedContinuation is a single-use, route-private prepared resume. Start follows the event-channel and setup-error rules of Harness.Execute. The service calls Start only after creating the child Fizeau session and acquiring that child's fresh lifecycle lease.

type QuotaHarness added in v0.14.1

type QuotaHarness interface {
	Harness

	// QuotaStatus returns the current quota state from the harness's
	// owned cache, with Fresh/Age computed against now. MUST be cheap
	// (no live probe) and safe to call on every routing decision.
	// Absence of evidence is reported via State=QuotaUnavailable on a
	// valid QuotaStatus value; the error return is reserved for call
	// failure (ctx cancelled, IO failure, lock acquisition failure).
	QuotaStatus(ctx context.Context, now time.Time) (QuotaStatus, error)

	// RefreshQuota drives the harness's live probe, persists the
	// result through the harness's owned cache, and returns the
	// resulting status. Single-flight per harness instance via the
	// harness's cache lock; concurrent callers block. Probe failure
	// is reported as a QuotaStatus with State=QuotaUnavailable (or
	// QuotaUnauthenticated for auth-related failures), not as an
	// error. The error return is reserved for call failure.
	RefreshQuota(ctx context.Context) (QuotaStatus, error)

	// QuotaFreshness returns the harness's freshness window (e.g. 15m).
	// Constant for the harness; cheap to call.
	QuotaFreshness() time.Duration

	// SupportedLimitIDs returns the harness's stable set of emitted
	// Windows[].LimitID values. Constant for the harness; the
	// conformance suite reads this value to verify that emitted
	// Windows[].LimitID strings are a subset of this set. Empty
	// slice is allowed for harnesses that emit no windows.
	SupportedLimitIDs() []string
}

QuotaHarness is implemented by harnesses that own a subscription or quota window. See CONTRACT-004 for the full normative contract.

type QuotaInfo

type QuotaInfo struct {
	PercentUsed int    `json:"percent_used"`
	LimitWindow string `json:"limit_window,omitempty"` // e.g. "5h", "7 day"
	ResetDate   string `json:"reset_date,omitempty"`   // e.g. "April 12"
}

QuotaInfo holds parsed quota data from CLI introspection.

func ParseQuotaOutput

func ParseQuotaOutput(output string) *QuotaInfo

ParseQuotaOutput parses the text output of a harness quota command. It extracts percent_used, limit_window, and reset_date. Returns nil if no quota data is found.

type QuotaStateValue added in v0.14.1

type QuotaStateValue string

QuotaStateValue is the normalized state enumeration consumed by CONTRACT-004 sub-interfaces. Only QuotaOK and QuotaStale carry routing-usable signal; other values MUST NOT result in RoutingPreferenceAvailable.

const (
	QuotaOK              QuotaStateValue = "ok"
	QuotaStale           QuotaStateValue = "stale"
	QuotaBlocked         QuotaStateValue = "blocked"
	QuotaUnavailable     QuotaStateValue = "unavailable"
	QuotaUnauthenticated QuotaStateValue = "unauthenticated"
	QuotaUnknown         QuotaStateValue = "unknown"
)

type QuotaStatus added in v0.14.1

type QuotaStatus struct {
	// Source identifies how the underlying evidence was captured:
	// "pty", "cache", "session-token-count", "cli", "api".
	Source string

	// CapturedAt is when the underlying evidence was observed (not when
	// this status struct was assembled).
	CapturedAt time.Time

	// Fresh reports whether CapturedAt is within QuotaFreshness() at the
	// time of the call.
	Fresh bool

	// Age is now - CapturedAt at the time of the call.
	Age time.Duration

	// State is the normalized state. Only QuotaOK and QuotaStale carry
	// routing-usable signal.
	State QuotaStateValue

	// Windows captures per-window evidence (5h, weekly, tier-specific).
	// Authoritative for any structured fact the routing layer or
	// operator surfaces consume — including tier breakdowns.
	Windows []QuotaWindow

	// Account is the account/plan/auth evidence captured alongside
	// quota. Nil when the harness has no concept of account or when
	// account evidence is delivered through AccountHarness only.
	Account *AccountSnapshot

	// RoutingPreference indicates whether the routing layer should
	// prefer this harness given the current evidence.
	RoutingPreference RoutingPreference

	// Reason is a short human-readable explanation of State and
	// RoutingPreference — surfaced in operator views and routing logs.
	Reason string

	// Detail is harness-specific opaque metadata for diagnostic display
	// only. Service code MAY surface it verbatim in operator views;
	// service code MUST NOT branch on its keys or values for routing
	// decisions.
	Detail map[string]string
}

QuotaStatus is the universal quota report defined by CONTRACT-004. Each harness's private snapshot type projects into this; the private snapshot is never exposed across package boundaries.

type QuotaWindow

type QuotaWindow struct {
	Name          string  `json:"name"`               // e.g. "5h", "7d", "spark"
	LimitID       string  `json:"limit_id,omitempty"` // provider limit_id
	LimitName     string  `json:"limit_name,omitempty"`
	WindowMinutes int     `json:"window_minutes"`
	UsedPercent   float64 `json:"used_percent"`
	ResetsAt      string  `json:"resets_at,omitempty"`      // human-readable
	ResetsAtUnix  int64   `json:"resets_at_unix,omitempty"` // unix timestamp
	State         string  `json:"state"`
}

QuotaWindow captures one quota window (e.g. 5h, weekly, model-specific).

type ReasoningActual added in v0.12.2

type ReasoningActual struct {
	Harness            string   `json:"harness,omitempty"`
	RequestedReasoning string   `json:"requested_reasoning,omitempty"`
	ResolvedReasoning  string   `json:"resolved_reasoning,omitempty"`
	Source             string   `json:"source,omitempty"`
	DiscoverySource    string   `json:"discovery_source,omitempty"`
	Reason             string   `json:"reason,omitempty"`
	Warning            string   `json:"warning,omitempty"`
	SupportedReasoning []string `json:"supported_reasoning,omitempty"`
}

func ResolveRunnerReasoning added in v0.12.2

func ResolveRunnerReasoning(harnessName, requestedReasoning string) ReasoningActual

func ResolveRunnerReasoningWithCache added in v0.12.2

func ResolveRunnerReasoningWithCache(cache *ModelDiscoveryCache, harnessName, requestedReasoning string) ReasoningActual

type Registry

type Registry struct {
	LookPath LookPathFunc
	// contains filtered or unexported fields
}

Registry manages known harnesses.

func NewRegistry

func NewRegistry() *Registry

NewRegistry creates a registry with builtin harnesses.

func NewRegistryForTest added in v0.15.0

func NewRegistryForTest(names ...string) *Registry

NewRegistryForTest creates an isolated registry containing only the named built-in harnesses. It lets cross-package composition tests constrain the complete candidate trace without exposing registry mutation to product callers (the harnesses package is internal).

func (*Registry) Discover

func (r *Registry) Discover() []HarnessStatus

Discover checks which harnesses are available on the system.

func (*Registry) FirstAvailable

func (r *Registry) FirstAvailable() (string, bool)

FirstAvailable returns the first available harness in preference order.

func (*Registry) Get

func (r *Registry) Get(name string) (HarnessConfig, bool)

Get returns a harness config by name.

func (*Registry) Has

func (r *Registry) Has(name string) bool

Has returns true if the harness is registered.

func (*Registry) Names

func (r *Registry) Names() []string

Names returns all registered harness names in preference order.

type RouteRunnerAuthority added in v0.15.0

type RouteRunnerAuthority struct {
	// contains filtered or unexported fields
}

RouteRunnerAuthority is the single service-owned authority for subprocess runner identity. It owns both the structural inventory representatives and exact per-route execution instances; the structural view is never used as a route lookup fallback.

func NewRouteRunnerAuthority added in v0.15.0

func NewRouteRunnerAuthority(structural map[string]Harness, factory RouteRunnerFactory) *RouteRunnerAuthority

NewRouteRunnerAuthority creates an authority with a defensive copy of the structural inventory. The factory is invoked at most once for each successfully bound exact key.

func (*RouteRunnerAuthority) Bind added in v0.15.0

Bind returns the immutable binding for key, constructing it atomically on first use. Factory failures and nil results are not cached, so a corrected environment can retry the same exact route.

func (*RouteRunnerAuthority) Lookup added in v0.15.0

Lookup performs exact-key lookup only. There is deliberately no name-only, display-name, wildcard, or partial-key lookup path.

func (*RouteRunnerAuthority) Register added in v0.15.0

Register installs runner for an exact key when no binding exists. It never replaces a prior registration.

func (*RouteRunnerAuthority) StructuralInstance added in v0.15.0

func (a *RouteRunnerAuthority) StructuralInstance(name string) Harness

StructuralInstance returns the inventory representative for a canonical harness name. It does not consult exact route registrations.

func (*RouteRunnerAuthority) StructuralInstances added in v0.15.0

func (a *RouteRunnerAuthority) StructuralInstances() map[string]Harness

StructuralInstances returns a defensive snapshot for inventory joins.

type RouteRunnerBinding added in v0.15.0

type RouteRunnerBinding struct {
	// contains filtered or unexported fields
}

RouteRunnerBinding couples an exact route identity to the runner instance registered for it. Only RouteRunnerAuthority can create a binding.

func (RouteRunnerBinding) Key added in v0.15.0

Key returns the exact route identity represented by the binding.

func (RouteRunnerBinding) Runner added in v0.15.0

func (b RouteRunnerBinding) Runner() Harness

Runner returns the service-owned runner registered for the exact key.

func (RouteRunnerBinding) Valid added in v0.15.0

func (b RouteRunnerBinding) Valid() bool

Valid reports whether the binding contains a registered runner.

type RouteRunnerFactory added in v0.15.0

type RouteRunnerFactory func(RouteRunnerKey, Harness) (Harness, error)

RouteRunnerFactory constructs one runner for one exact route identity from the authority-owned structural prototype for that harness. The prototype carries activated/configured launch state; a production factory clones it when endpoint-distinct instances are required.

type RouteRunnerKey added in v0.15.0

type RouteRunnerKey struct {
	Harness        string
	Provider       string
	Endpoint       string
	ServerInstance string
	Model          string
}

RouteRunnerKey is the exact identity of one service-owned subprocess route. Empty fields are literal identity values: callers must not substitute defaults, wildcards, display names, or partial-key fallbacks.

type RoutingActual

type RoutingActual struct {
	Harness            string   `json:"harness"`
	Provider           string   `json:"provider,omitempty"`
	ServerInstance     string   `json:"server_instance,omitempty"`
	Model              string   `json:"model"`
	FallbackChainFired []string `json:"fallback_chain_fired,omitempty"`
	FailureClass       string   `json:"failure_class,omitempty"`
	// Power is the catalog-projected power of the actually-dispatched
	// Model. 0 means unknown/exact-pin-only/no catalog entry.
	Power int `json:"power,omitempty"`
}

RoutingActual captures the resolved fallback chain on a final event.

type RoutingPreference added in v0.14.1

type RoutingPreference int

RoutingPreference is the routing layer's consumable signal indicating whether a harness should be preferred given its current quota evidence. It is an internal routing signal — never projected into the public CONTRACT-003 surface.

const (
	RoutingPreferenceUnknown RoutingPreference = iota
	RoutingPreferenceAvailable
	RoutingPreferenceBlocked
)

type RunnerModelResolution added in v0.12.2

type RunnerModelResolution struct {
	HarnessName       string `json:"harness_name"`
	RequestedModel    string `json:"requested_model,omitempty"`
	ResolvedModel     string `json:"resolved_model"`
	PriorDefaultModel string `json:"prior_default_model,omitempty"`
	Source            string `json:"source"`
	Surface           string `json:"surface"`
	Warning           string `json:"warning,omitempty"`
	Reason            string `json:"reason,omitempty"`
	ExplicitPin       bool   `json:"explicit_pin,omitempty"`
}

func ResolveRunnerModel added in v0.12.2

func ResolveRunnerModel(harnessName string, surface modelcatalog.Surface, requestedModel, fallbackDefault string) RunnerModelResolution

func ResolveRunnerModelWithCache added in v0.12.2

func ResolveRunnerModelWithCache(cache *ModelDiscoveryCache, harnessName string, surface modelcatalog.Surface, requestedModel, fallbackDefault string) RunnerModelResolution

type SessionOutcome added in v0.15.0

type SessionOutcome string

SessionOutcome is the stable coarse result of one accepted Fizeau session. It is distinct from FinalData.Status, which remains a compatibility/detail field for older consumers.

const (
	SessionOutcomeSuccess   SessionOutcome = "success"
	SessionOutcomeFailed    SessionOutcome = "failed"
	SessionOutcomeCancelled SessionOutcome = "cancelled"
	SessionOutcomeTimedOut  SessionOutcome = "timed_out"
)

type SessionStage added in v0.15.0

type SessionStage string

SessionStage identifies the Fizeau-owned lifecycle stage that determined a terminal result. It intentionally contains no outer workflow stages.

const (
	SessionStageRouting      SessionStage = "routing"
	SessionStageSpawn        SessionStage = "spawn"
	SessionStageHarness      SessionStage = "harness"
	SessionStageProvider     SessionStage = "provider"
	SessionStageToolLoop     SessionStage = "tool_loop"
	SessionStageTimeout      SessionStage = "timeout"
	SessionStageCancellation SessionStage = "cancellation"
	SessionStageCleanup      SessionStage = "cleanup"
)

type TerminalCause added in v0.15.0

type TerminalCause string

TerminalCause is the stable, machine-readable reason a session ended.

const (
	TerminalCauseCompleted               TerminalCause = "completed"
	TerminalCauseRouteUnavailable        TerminalCause = "route_unavailable"
	TerminalCauseSpawnFailed             TerminalCause = "spawn_failed"
	TerminalCauseHarnessFailed           TerminalCause = "harness_failed"
	TerminalCauseProviderFailed          TerminalCause = "provider_failed"
	TerminalCauseToolLoopFailed          TerminalCause = "tool_loop_failed"
	TerminalCauseIterationLimit          TerminalCause = "iteration_limit"
	TerminalCauseBudgetHalted            TerminalCause = "budget_halted"
	TerminalCauseContextCapacityExceeded TerminalCause = "context_capacity_exceeded"
	TerminalCauseDeadlineExceeded        TerminalCause = "deadline_exceeded"
	TerminalCauseContextCancelled        TerminalCause = "context_cancelled"
	TerminalCauseCallerDied              TerminalCause = "caller_died"
	TerminalCauseCleanupFailed           TerminalCause = "cleanup_failed"
	TerminalCauseInternalError           TerminalCause = "internal_error"
)

type TextDeltaData

type TextDeltaData struct {
	Text string `json:"text"`
}

TextDeltaData is the payload for type=text_delta events.

type ToolCallData

type ToolCallData struct {
	ID    string          `json:"id"`
	Name  string          `json:"name"`
	Input json.RawMessage `json:"input,omitempty"`
}

ToolCallData is the payload for type=tool_call events.

type ToolResultData

type ToolResultData struct {
	ID         string `json:"id"`
	Output     string `json:"output,omitempty"`
	Error      string `json:"error,omitempty"`
	DurationMS int64  `json:"duration_ms,omitempty"`
}

ToolResultData is the payload for type=tool_result events.

type UsageCandidate

type UsageCandidate struct {
	Source     string
	Fresh      *bool
	CapturedAt string
	Counts     UsageTokenCounts
	Warning    string
}

UsageCandidate is one candidate source considered for final token usage.

type UsageSourceEvidence

type UsageSourceEvidence struct {
	Source     string            `json:"source"`
	Fresh      *bool             `json:"fresh,omitempty"`
	CapturedAt string            `json:"captured_at,omitempty"`
	Usage      *UsageTokenCounts `json:"usage,omitempty"`
	Warning    string            `json:"warning,omitempty"`
}

UsageSourceEvidence records one usage source considered by the resolver.

type UsageTokenCounts

type UsageTokenCounts struct {
	InputTokens      *int `json:"input_tokens,omitempty"`
	OutputTokens     *int `json:"output_tokens,omitempty"`
	CacheReadTokens  *int `json:"cache_read_tokens,omitempty"`
	CacheWriteTokens *int `json:"cache_write_tokens,omitempty"`
	CacheTokens      *int `json:"cache_tokens,omitempty"`
	ReasoningTokens  *int `json:"reasoning_tokens,omitempty"`
	TotalTokens      *int `json:"total_tokens,omitempty"`
}

UsageTokenCounts is the normalized token-count vocabulary shared by subprocess harnesses and CONTRACT-003 final metadata.

func ParseUsageJSON

func ParseUsageJSON(raw json.RawMessage) (UsageTokenCounts, error)

ParseUsageJSON normalizes common Claude/Codex/OpenAI-style usage objects. Unknown dimensions remain nil. A present zero remains present.

func (UsageTokenCounts) Any

func (c UsageTokenCounts) Any() bool

Any reports whether at least one token dimension is known.

Directories

Path Synopsis
Package anthropic contains shared Anthropic CLI/TUI harness helpers and types, including the single owner of Claude Code's normalized native-install and account/configuration portable assets.
Package anthropic contains shared Anthropic CLI/TUI harness helpers and types, including the single owner of Claude Code's normalized native-install and account/configuration portable assets.
Package claude implements the CONTRACT-004 harness contracts for Anthropic's claude CLI: Harness, QuotaHarness, AccountHarness, and ModelDiscoveryHarness, and PortableRuntimeHarness.
Package claude implements the CONTRACT-004 harness contracts for Anthropic's claude CLI: Harness, QuotaHarness, AccountHarness, and ModelDiscoveryHarness, and PortableRuntimeHarness.
Package claudetui provides the claude TUI harness implementing harnesses.Harness over one lifecycle-contained PTY per invocation, with hook-based progress events and transcript-derived final output.
Package claudetui provides the claude TUI harness implementing harnesses.Harness over one lifecycle-contained PTY per invocation, with hook-based progress events and transcript-derived final output.
Package codex implements the CONTRACT-004 harness contracts for OpenAI's Codex CLI: Harness, QuotaHarness, AccountHarness, ModelDiscoveryHarness, and PortableRuntimeHarness.
Package codex implements the CONTRACT-004 harness contracts for OpenAI's Codex CLI: Harness, QuotaHarness, AccountHarness, ModelDiscoveryHarness, and PortableRuntimeHarness.
Package gemini implements the CONTRACT-004 harness contracts for Google's gemini CLI: Harness, QuotaHarness, AccountHarness, and ModelDiscoveryHarness.
Package gemini implements the CONTRACT-004 harness contracts for Google's gemini CLI: Harness, QuotaHarness, AccountHarness, and ModelDiscoveryHarness.
Package grok implements the CONTRACT-004 harness contracts for xAI's Grok Build CLI: Harness, QuotaHarness, AccountHarness, and ModelDiscoveryHarness.
Package grok implements the CONTRACT-004 harness contracts for xAI's Grok Build CLI: Harness, QuotaHarness, AccountHarness, and ModelDiscoveryHarness.
Package harnesstest provides shared conformance assertions and in-memory synthetic implementations of the CONTRACT-004 harness sub-interfaces.
Package harnesstest provides shared conformance assertions and in-memory synthetic implementations of the CONTRACT-004 harness sub-interfaces.
Package opencode implements the opencode subprocess harness.
Package opencode implements the opencode subprocess harness.
Package pi implements the pi subprocess harness.
Package pi implements the pi subprocess harness.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL